> What's serialised is not identity but state. These are not mutually exclusive and they describe actually two very different concepts. If your objects will e

> What's serialised is not identity but state. These are not mutually exclusive and they describe actually two very different concepts. If your objects will end up in a hashing container, you absolutely need to serialize what makes their identity. If not, you can serialize whatever you need from the object. It can be more fields than its identity, or fewer. I'm not sure what your following point about serialization vulnerability (however correct) has to do with the current discussion.